diff --git a/action.yml b/action.yml
index a8f47e6..1186113 100644
--- a/action.yml
+++ b/action.yml
@@ -155,9 +155,31 @@ runs:
         # the wrapper in the `GITHUB_WORKSPACE` to avoid polluting repo files.
         # Prefer runner-specific temp folders (RUNNER_TEMP), then /tmp.
         TEMP_DIR="${RUNNER_TEMP:-/tmp}"
-        WRAPPER_DIR=$(mktemp -d "$TEMP_DIR/setup-ssh-client-XXXXXX")
+        # Create temporary directory. mktemp implementation differs between
+        # Linux (GNU coreutils) and macOS (BSD). Use common-fallback patterns
+        # to be portable across runners.
+        if WRAPPER_DIR=$(mktemp -d "$TEMP_DIR/setup-ssh-client-XXXXXX" 2>/dev/null); then
+          :
+        elif WRAPPER_DIR=$(mktemp -d -p "$TEMP_DIR" setup-ssh-client-XXXXXX 2>/dev/null); then
+          :
+        else
+          WRAPPER_DIR="$TEMP_DIR/setup-ssh-client-$(date +%s)-$$"
+          mkdir -p "$WRAPPER_DIR"
+        fi
         mkdir -p "$WRAPPER_DIR"
-        WRAPPER_PATH="${mktemp "$WRAPPER_DIR/ssh-remote-shell-XXXXXX.sh"}"
+        # Use command substitution $(...) — earlier use of ${...} is invalid and
+        # caused a "bad substitution" error in POSIX shells. `mktemp` accepts a
+        # template including a directory, but options differ between GNU and BSD
+        # implementations. Use template first, and fall back to -p for macOS.
+        if WRAPPER_PATH=$(mktemp "$WRAPPER_DIR/ssh-remote-shell-XXXXXX.sh" 2>/dev/null); then
+          : # created by GNU extension or compatible mktemp
+        elif WRAPPER_PATH=$(mktemp -p "$WRAPPER_DIR" ssh-remote-shell-XXXXXX.sh 2>/dev/null); then
+          : # fallback for BSD mktemp on macOS
+        else
+          # Last resort: generate a safe filename and create it
+          WRAPPER_PATH="$WRAPPER_DIR/ssh-remote-shell-$(date +%s)-$$.sh"
+          : > "$WRAPPER_PATH"
+        fi
         
         cat << 'WRAPPER_EOF' > "$WRAPPER_PATH"
         #!/bin/bash